CVE-2026-78807 in wpa_supplicant
Summary
by MITRE • 09/11/2026
An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in wpa_supplicant prior to version 2.12 represents a critical flaw in the implementation of Protected Management Frame (PMF) and Pairwise Master Key Identifier (PMKID) caching mechanisms within wireless network authentication processes. This issue specifically affects the driver-based PMKSA selection path located in the wpa.c source file, where insufficient validation logic allows for improper handling of Network Context and Authentication Key Management Protocol (AKMP) matching during the reauthentication phase. In standard IEEE 802.11 operations, when a client moves between access points or reconnects to an existing network, it utilizes PMKSA caching to expedite the handshake process by skipping full authentication exchanges if valid credentials are cached locally. The flaw arises because wpa_supplicant fails to rigorously verify that the cached Pairwise Master Key Security Association (PMKSA) corresponds correctly to the current network context and the specific AKMP type negotiated or expected for the connection attempt.
From a technical perspective, this lack of validation creates a scenario where an attacker operating within local proximity can manipulate the association process to bypass proper security checks. By exploiting the missing validation in the driver-based selection path, an adversary can force the supplicant to accept a PMKSA that was established under different network conditions or with incompatible authentication parameters. This effectively allows the client to authenticate using stale or mismatched credentials without performing the necessary cryptographic verification steps required for secure reconnection. The core of the vulnerability lies in the failure to cross-reference the stored security context against the current operational environment, thereby undermining the integrity of the key management protocol and allowing unauthorized access through credential reuse across incompatible contexts.
The operational impact of this vulnerability is significant as it compromises the confidentiality and authenticity guarantees provided by WPA2 and WPA3 enterprise networks that rely on robust PMKSA caching for seamless roaming. An attacker with local network access can potentially intercept traffic, perform man-in-the-middle attacks, or gain unauthorized entry into secured wireless segments without possessing valid long-term credentials for the specific current context. This bypasses essential security controls designed to prevent replay attacks and credential theft during reauthentication phases. The severity is heightened in environments where devices frequently roam between different network zones with varying security policies, as the supplicant may incorrectly apply a high-security PMKSA from one zone to a lower-security or distinct network environment, leading to potential data exposure and lateral movement opportunities for threat actors within the local broadcast domain.
To mitigate this risk, organizations must ensure that all wpa_supplicant instances are upgraded to version 2.12 or later, where the validation logic in the driver-based PMKSA selection path has been corrected to enforce strict matching of network context and AKMP parameters before accepting cached security associations. Additionally, administrators should review their wireless infrastructure configurations to minimize reliance on aggressive caching policies that might exacerbate exposure during transitional periods. Implementing monitoring solutions capable of detecting anomalous reauthentication patterns or unexpected changes in PMKID usage can provide early warning indicators of exploitation attempts. Regular auditing of supplicant logs for validation failures and ensuring strict adherence to IEEE 802.11 standards regarding context switching are essential practices to maintain the integrity of wireless authentication frameworks against this class of logic flaws. This vulnerability is categorized under CWE-20 Improper Input Validation as it stems from a failure to adequately sanitize or verify inputs related to security contexts, and aligns with ATT&CK technique T1557 Adversary-in-the-Middle which describes the potential for intercepting communications by exploiting authentication bypasses in network protocols.